# Basic one way hash to store a password C#

I am storing a password in a database (school coursework so nothing too complicated but I want to challenge myself), I am using a one way hash function, is this suitable? It works I just feel there may be nicer ways of storing the password. The database is SQL, language is C#

static class Encryption
{
public static string OneWayEncrpyt(string toEncrypt)
{
data = new System.Security.Cryptography.SHA256Managed().ComputeHash(data);
return System.Text.Encoding.ASCII.GetString(data);
}
}


No, it isnt.

First, you only allow ASCII characters in the password. If I were to choose €¥≠≥≤©® as my password, it would probably be equivalent to choosing ??????? (7 question marks). Try it.

Second, a password hashing function must be slow. Otherwise it is too easy to crack the password.

Third, when you hash a password, you must add some salt to it. This has the effect that even when two people use the same password, the hashed passwords are different, so a possible attacker cannot group people by their passwords.

Fourth, if you print the hashed password and it contains lots of question marks, you are doing it wrong. Instead of converting the hash bytes directly to a string, you must encode them so that only printable characters remain. Typical choices for such an encoding are base64 and hex.

In every possible scenario, even in school, you should use an established algorithm like bcrypt or scrypt instead of inventing your own.

• Ah ok, I have a lot of validation using REGEX, not shown cause it's held in custom controls elsewhere.. I have it validated I should edit to say that! How do I make it slow and how do I add salt can I get some explanation please? Thanks Oct 12, 2017 at 22:22
• There are already enough explanations on the internet. I gave you the relevant keywords, the rest is up to you. :) Oct 12, 2017 at 22:26
• Yes I have googled bcrypt, and found what a salt was. Thanks for the direction Oct 12, 2017 at 22:29